CISA’s Known Exploited Vulnerabilities (KEV) catalog is useful evidence for security teams, but a long list of CVEs can be difficult to explore. I built KEV Observatory to turn that public dataset into a searchable, interactive dashboard.
Try the live dashboard · Browse the source on GitHub
What you can explore
The dashboard answers three questions:
- Which vendors have the most entries in the selected records?
- Which weakness categories appear most often?
- How have catalog additions changed over time?
Search by CVE, vendor, product or CWE. Combine vendor, year-added and ransomware-use filters to update the statistics, charts and table together. Open a CVE to inspect its description, CISA’s required action, deadline and source notes. Export the filtered records as CSV, or download the dashboard as a self-contained HTML file.
What this snapshot shows
The embedded catalog was released on 13 October 2026 and retrieved on 14 October 2026. It contains 1,741 CVEs across 288 distinct vendor labels.
In this snapshot:
- Microsoft has 390 entries, or 22.4% of the catalog.
- 361 entries, or 20.7%, are marked as used in known ransomware campaigns.
- CWE-20 is the most frequent CWE label, appearing 119 times.
- 32 CVEs were added in the last 30 days relative to the snapshot date.
These are descriptive findings about the catalog. They do not rank vendors by security quality: counts are not normalized for market share, product count or disclosure practices. A CVE can also have multiple CWE labels.
Keeping the interpretation honest
KEV inclusion means there is evidence of exploitation in the wild. It does not prove that a visitor’s own systems are affected, and this app does not assign a severity score.
Other distinctions matter too:
- The catalog’s addition date is not the date exploitation first occurred.
- “Unknown” ransomware use does not mean “No.”
- CISA due dates apply to relevant U.S. federal civilian agencies; they do not establish that another organization is overdue.
- The dashboard uses a fixed snapshot, not a live feed.
Before using a finding operationally, match the affected product and version to your asset inventory and review the vendor’s guidance.
How it works
KEV Observatory uses plain HTML, CSS and JavaScript with the public dataset embedded in the page. It needs no API key, account, external JavaScript library or backend. The downloaded HTML works offline. It does not collect personal information, send telemetry, scan systems or execute exploits.
The source includes build and validation scripts. Checks cover catalog integrity and unique CVE identifiers, filtering, aggregation, HTML escaping, CSV formula protection, offline embedding and JavaScript syntax. Browser checks covered search, combined filters, CVE details, pagination and empty results.
To rebuild locally:
node build.cjs
node test.cjs
The development lesson for me was that a dashboard should explain its evidence and limitations as clearly as it displays its charts.
Built by Onkar Singh Pawar, with AI assistance for development, testing and this article.
Data sources: CISA KEV catalog and CISA’s official dataset repository.
Top comments (0)